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Blind quantum computation with completely classical client and a trusted center 
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Blind quantum computation (BQC) enables a client without enough quantum power to delegate 
his quantum computation to a quantum server, while keeping the input data, the algorithm and 
the result unknown to the server. In the studies of practical BQC protocol, an important problem 
is how to reduce the quantum requirement of the client. Multi-server BQC protocols have been 
proposed to solve this problem. We review the double-server and triple-server protocols [Li et ah, 
Phys. Rev. A 89, 040302(R) (2014)], and propose a modified double-server BQC protocol with a 
trusted center. In our protocol, the servers are allowed to communicate mutually, and the client is 
completely classical. Furthermore, our double-server protocol can be modified into a single-server 
protocol by simply combining the two servers. Compared with the triple-server protocol, our double¬ 
server and single-server protocols are more simple and the client is not required to have the ability 
to access quantum channel. So our protocols are more practical when quantum computer is applied 
in the ‘cloud’ model. 

PACS numbers: 03.67.Ac, 03.67.Dd, 03.67.Lx 


I. INTRODUCTION 

Blind quantum computation (BQC) is a kind of se¬ 
cure computation protocol involving two roles, where the 
client has the data and the algorithm, and the server has 
a quantum computer. In BQC protocol, the client in¬ 
structs the server to perform quantum computation on 
his data without leaking any information about the data, 
the algorithm and even the final result. BQC protocol 
should have the properties of blindness, correctness and 
verifiability. The blindness means that the data, the al¬ 
gorithm and the result are only known by the client; the 
correctness means that the client can obtain the correct 
outcome after the protocol being finished; the verifiabil¬ 
ity means that the client can check whether the server 
performs the computation following his instructions. 

The research of BQC protocol begins from Ref.[T], 
which construct some BQC protocols for each of the ba¬ 
sic quantum gates (Hadamard gate, CNOT gate, and tt/S 
gate). Because any quantum circuit can be implemented 
by a combination of these basic gates, the BQC proto¬ 
col can implement any quantum circuit. However, this 
protocol does not satisfy the requirement of verifiability. 
Arrighi and Salvail [5] proposed another BQC protocol, 
which is not universal since it is only used for computing 
some classical functions. Based on quantum authentica¬ 
tion scheme, Aharonov et al. [3] proposed an interactive 
proof system for quantum computation, which can also 
be used as a BQC protocol. However, the client must 
perform lots of quantum computation in the quantum 
authentication encoding. Based on measurement-based 
quantum computation model, Broadbent et al. [1] pro¬ 
posed the first universal BQC protocol, in which the 
client only needs to prepare some single-qubit states. 
Currently, lots of researches have been proposed to make 
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the BQC protocols more optimal or practical [5HTU|. For 
example. Ref. [5] improved the fault-tolerant threshold for 
BQC by topological quantum computation, and Ref. m 
studied the optimization of the BQC protocol from the 
aspect of quantum communication. 

All the mentioned protocols are single-server BQC pro¬ 
tocols, in which the client must have some quantum abil¬ 
ities, such as the ability to prepare or measure single 
qubit mn]. An important effort in the researches of 
practical BQC protocol is reducing the quantum require¬ 
ment of the client. If the client is limited to only be able 
to carry out classical computation, we have to increase 
the number of the servers and devise the multi-server 
BQC protocols. Actually, Broadbent et al.[l] proposed 
a double-server protocol, where the client is completely 
classical and the two servers cannot communicate mu¬ 
tually. The double-server protocols in Ref. m [ig also 
assume the noncommunicating of the two servers. Later, 
Li et al. m proposed a triple-server BQC protocol, in 
which the client is almost classical (the client can only 
access the quantum channel) and the servers are allowed 
to communicate with each other. 

We review and analyze the main multi-server BQC pro¬ 
tocols, and devise a double-server BQC protocol with 
completely classical client, where the two servers are al¬ 
lowed to communicate mutually. In our protocol, the 
trusted center should prepare Bell states and send them 
to the servers. In addition, it is necessary that there ex¬ 
ists a private classical channel from the trusted center to 
the client. 


II. REVIEWS AND ANALYSIS 

Before introducing our double-server BQC protocol, we 
review the single-server BQC protocol and double-server 
BQC protocol in Ref. [4], the modified double-sever BQC 
protocol in Ref. [13], and the triple-server BQC protocol 
in Ref. |14j . 
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Let the set S = {O, ..., and (p Gr S means 

(j) is randomly chosen from the set S. The notation | ± (p) 
denotes the qubit |0) ± e®‘^|l). 


A. BFK single-server protocol 

Client wants to finish a quantum computation. As¬ 
sume he has in mind the quantum computation on the 
n-qubit graph state corresponding to the graph G. The 
quantum operation that Client wants to perform is to 
measure the *th qubit in the basis {| ± (pi)}- 

SI: Client prepares n qubits and sends them to Server. 
The state of each qubit is \9i) = |0) -I- e*®’|l)(i = 
1, 2,..., n), where 9i is uniformly chosen from the 
set S. 

S2: Server produces the brickwork state |G(0)) by apply¬ 
ing controlled-Z gates on the received qubits based 
on the graph G. 

S3: For i = 1,2, ...,n, Client randomly chooses S 
{0,1} and computes 5i = {9i (p'^ + r.i7r)mod27r, 

where (p'^ is obtained according to the previous mea¬ 
surements and (pi, and then Si is sent to Server 
if Client needs Server to measure the tth qubit of 
|G(0)). 

S4: Server performs a measurement on the ith {i = 
1, 2,..., n) qubit in the basis {| ± <5^)} and informs 
Client about the measurement result. 

This single-server BQC protocol can be modified to 
be a BQC protocol with authentication where a cheating 
server can be found with probability exponentially ap¬ 
proaching one [2]. All the protocols that are introduced 
in this article do not have the property of authentication, 
however, they can also be modified to be a BQC protocol 
with authentication in the similar way. More details can 
be found in Ref. [2] . We do not discuss the authentication 
here. 

Notice that there is no explicit input in the protocol. 
In fact, the preparation of the initial input state can be 
included in the algorithm of quantum computation. For 
example, in the steps S3 and S4, Client can instruct 
Server to prepare the input state and perform the quan¬ 
tum computation on the state. Obviously, the input state 
is still unknown to Server. 


B. Double-server BQC protocols 

Broadbent et al.[2] point out an important problem: 
does there exist a BQC protocol which permits a com¬ 
pletely classical client? They present a solution which is 
based on two entangled servers; However, the two servers 
are not allowed to communicate with each other. In the 


following, we firstly review this double-server BQC pro¬ 
tocol [2] (it is named BFK double-server protocol in this 
article), and then introduce a modified version [T5] . 

Bell states are used in the protocols. The Bell state of 
a pair of particles (a, 5) can be denoted by \Lpx,z{.c(,b)) = 
(J ® X^Z^)^{\m)a,b + |ll)a.&), where x,z€ {0,1}. 

Initialization: The trusted center distributes 
Bell states to Serverl and Server2. 

The trusted center prepares n Bell states |(po,o(^i, Bi)) 
{i = 1, ... ,n). He sends the n particles Ai,..., A„ to 
Serverl, and sends the n particles Hi,..., to Server2. 
Stage 1: Client’s preparation with Serverl 

Dl-1: Client independently chooses n random values 
9i Gr S (i = 1,... ,n), and sends them to Serverl; 

Dl-2: According to the n bases {| ± Serverl 

performs quantum measurements on his particles 
Ai, ..., An and obtains n bits, which are denoted 
as Then he sends these bits to Client. 

Stage 2: Client’s computation with Server2 

D2-1: Similar to S2, Server2 produces the brickwork 
state using all his qubits; 

D2-2: Client starts the BFK single-server BQC protocol 
with Server2 from the step S3, replacing 9i with 
9i -G ijiiTT (i = 1,... ,n). 

In this double-server BQC protocol. Client is only re¬ 
quired to do classical computation, and the two servers 
are not allowed to communicate with each other. It 
is worth to notice that, the information and 

should be transmitted through a private chan¬ 
nel (for example, a secure encryption algorithm is used) 
between Client and Serverl; Otherwise, Server2 may ob¬ 
tain the values of {9i}2^i and break the blindness of the 
protocol. 

A modified version of the above double-server BQC 
protocol is proposed by Morimae and Fujii in Ref. [13]. 
They present a secure entanglement distillation scheme 
for the double-server BQC protocol. Ref.[T3] gives out a 
better entanglement distillation scheme with higher effi¬ 
ciency. We briefly review Morimae and Fujii’s protocol 
without entanglement distillation as follows. 

Initialization: The trusted center distributes 
Bell states \(pxi,zi{Ai, Bi)) to Serverl and Server2, 
where Xi, Zi are known by Client and i G {1,..., n}. 
Stage 1: Client’s preparation with Serverl 

Ml-1: Client independently chooses n random values 
{9i Gr 5'}r=i) sends the messages {0' = 
(— l)“‘0i -I- ZiTr}^^^ to Serverl; 

Ml-2: According to the n bases {| ± Serverl 

performs quantum measurements on his particles 
Ai, ..., An, and obtains n bits {mi}^^^; Then he 
sends these bits to Client. 

Stage 2: Client’s computation with Server2 
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M2-1: Same as D2-1. 

M2-2: Same as D2-2. 

The above protocol is an improved version of BFK 
double-server BQC protocol. In the BFK double-server 
BQC protocol, the shared entanglement between the two 
servers is ^(|00) -I- |11)), and Serverl performs quantum 
measurement on the first particle according to the basis 
I ± 0i); In the modified version, the shared entanglement 
between the two servers is (J 0 ^(|00) -I- |11)), 

and Serverl performs quantum measurement on the first 
particle according to the basis | ± ((—-I- Ziir)). Ac¬ 
tually, they are equivalent since the measurement out¬ 
come of the particle a in according to the 

basis I ± {{—l)^'9i + Ziir)) is equal to the measurement 
outcome of the particle a in |i^o,o(a) b)) according to the 
basis I ± 0i). 

C. Triple-server BQC protocol 

In the reviewed double-server protocols, the two 
servers are not allowed to communicate with each other. 
It is unrealistic to forbid two quantum servers to com¬ 
municate mutually. So, the researchers try to solve 
this problem. Based on entanglement swapping and the 
above modified protocol, Li et al. m devised a triple¬ 
server BQC protocol in which the three quantum servers 
can communicate mutually. However, the client is not 
completely classical, and must have the ability to access 
the quantum channel. The protocol has the following 
four stages. 

Initialization: The trusted center distributes 
Bell states to Serverl, Server2 and Client. 

TO-1: The trusted center produces n = (2 -|- 5)m Bell 
states \^pQfi{Ai,Bli)) {i = l,...,n). He sends the 
n particles Ai,... ,An to Client, and sends the n 
particles Bli, ..., i?l„ to Serverl. 

TO-2: The trusted center produces n Bell states 
\ipofi{A[, B2i)) (* = 1,..., n). He sends the n parti¬ 
cles A'i,...,A'^ to Client, and sends the n particles 
H2i,..., B2n to Server2. 

Stage 1: Client’s preparation with Servers 

Tl-1: For each particle Ak or A\ arriving, Client ran¬ 
domly chooses one of the two choices: (a) discard¬ 
ing it, or (b) transmitting it to ServerS and record¬ 
ing its position. 

Tl-2: Servers may receive 2m particles from Client, 
where the m particles that are entangled with 
Serverl are denoted as ,..., A ^^, and m par¬ 
ticles that are entangled with Server2 are denoted 
as A [^,..., A[^. Servers performs Bell measure¬ 
ment on the m pairs of particles {(Ag., AJJ}™ 
and sends the result {{xt, Zi)}'^^ to Client. 


Stage 2: Client’s preparation with Serverl 

T2-1: Client chooses n values {0^}?=! sends the val¬ 
ues of {e[ = (-1)^-0, to Serverl. 

are distributed as uniformly as possible over all the 
eight elements of the set S. 

T2-2: According to the bases {| ± Serverl per¬ 

forms quantum measurements on the n particles 
i?li,...,Hl„, and sends the result to 

Client. Client only keeps the values of {mg.}™!. 

Stage 3: Client’s computation with Server2 

T3-1: Client asks Server2 to keep the m qubits which 
are labeled as Notice that the m qubits 

can be represented as {|0si+Wg.7r)}^;^ at this time. 
Similar to S2, Server2 produces the brickwork state 
using the m qubits. 

T3-2: Client starts the reviewed single-server BQC pro¬ 
tocol with Server2 from the step S3, replacing 9i 
with 9si + Wg-TT (z = 1 ,...,to). 

Compared with Morimae and Fujii’s double-server 
BQC protocol m. the above protocol has added an¬ 
other quantum server ServerS. Actually, for the re¬ 
ceived particles, he just performs some Bell measure¬ 
ments on these particles. If the zth measurement result 
is (xi, Zi), Client can know the entanglement has been es¬ 
tablished between Serverl’s particle Big. and Server2’s 
particle B2t. , and the combined state of Big. and B2t. is 
\‘Pxi,ziiBlsi, B2t-)). Then, Client starts the interactive 
procedure with Serverl and Server2 that are similar to 
Morimae and Fujii’s double-server protocol. 

In the triple-server protocol, the three servers are al¬ 
lowed to communicate mutually, and can be modified to 
be a single-server BQC protocol, in which the client is 
also an almost classical user. More details can be found 
in Ref.[T2]. Recently, Ref.[T7] points out a security loop¬ 
hole in both this triple-server protocol and the single¬ 
server protocol in Ref. [16] 

III. BLIND QUANTUM COMPUTATION WITH 
COMPLETELY CLASSICAL CLIENT 

Generally, single-server BQC protocols require the 
client to have some quantum ability, such as the abil¬ 
ity to produce single-qubit states or make quantum mea¬ 
surements. If the client can only perform classical com¬ 
putation, the BQC protocols require at least two quan¬ 
tum servers. For example, the double-server BQC pro¬ 
tocol in Ref. [4] only requires the client to have a classi¬ 
cal computer. However, all the double-server protocols 
11E1II3] assume the servers cannot communicate mu¬ 
tually. Ref.[l4] proposes a triple-server BQC protocl, in 
which the three servers are allowed to communicate mu¬ 
tually. However, the client is almost classical because he 
needs to access quantum channel. 
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In this section, we will propose a new modified double¬ 
server BQC protocol, which allows a completely classi¬ 
cal client and the two servers are allowed to communi¬ 
cate mutually. In our protocol, the client and the servers 
are connected by the bidirectional classical channels, and 
there exists an unidirectional classical channel from the 
trusted center to the client. There are an unidirectional 
quantum channel from the trusted center to each server. 
See FigureJ^ 


CC; Classical channel, QC: Quantum channel 



FIG. 1. The diagram of our modified double-server BQC 
protocol. In the diagram, ‘CC’ and ‘QC’ represent the clas¬ 
sical channel and the quantum channel, respectively. The 
trusted center and each server are connected by an unidirec¬ 
tional quantum channel. The trusted center and the client are 
connected by an unidirectional classical channel. The client 
and each server are connected by the bidirectional classical 
channel. 

The protocol has the following three stages: Initializa¬ 
tion, Stage 1 and Stage 2. 

Initialization: The trusted center distributes 
Bell states to Server 1 and Server2, and sends clas¬ 
sical secret information to Client. 

PO-1: The trusted center randomly chooses n pairs of 
bits {(xi, and a n-ary permutation P, and 

sends them to Client through the classical channel 
in a secure way; 

PO-2: The trusted center prepares n Bell states 
\<Pxi,zi(,Ai, Bi)), i = l,...,n, and sends the parti¬ 
cles Ai,...,An to Server 1 in sequence. Then he 
sends the particles ..., to Server2 

in the order which depends on the permutation P. 

Stage 1: Client’s preparation with Serverl 

Pl-1: Client independently chooses n random values 
{0i}2=i from the set S, and sends the values of 
{0' = -h ZiTT mod27r}^^i to Serverl; 

Pl-2: According to the n bases {| ±0')}"^;^, Serverl per¬ 
forms quantum measurements on the n particles 
and obtains n bits. Denotes the n bits as 
{^i}2=i- He sends these bits to Client. 


Stage 2: Client’s computation with Server2 

P2-1: Similar to S2, Server2 produces the brickwork 
state using the n particles i?p-i(i),..., 

P2-2: Client starts the BFK single-server BQC protocol 
with Server2 from the step S3, replacing 9i with 
0p-^{i) + Wp-i(i)7r (or let 0p(q = 9i miir), i = 

l,...,n. 

According to the step P2-2, it is obvious that Client 
can run the correct single-server blind quantum compu¬ 
tation with Server2. 

Next, we show that the above modified double-server 
BQC protocol is secure even if the two servers communi¬ 
cate mutually. 

Suppose Serverl and Server2 can communicate with 
each other, they may cooperate and attempt to obtain 
the information related to Client’s quantum computa¬ 
tion, such as something about or As¬ 
sume that Server2 who knows is chosen to do such 

thing. Serverl tells his information and 

to Server2. Server2 still cannot learn anything about 
{^i}r=i or The analysis is as follows. 

1. Server2 cannot know the values of {{xi, and 

the permutation P since they are Client’s secret in¬ 
formation which are transmitted from the trusted 
center through a secure channel. Though the Bell 
measurement on the pair of particles (Ai,Bi) can 
result the values of Xi and Zi, Server2 cannot know 
which particle is B^ since the order of the parti¬ 
cles {Bi}f^^ has been rearranged by the unknown 
permutation P. 

2. Without the knowledge of {(a;^, it is impos¬ 

sible for Server2 to compute the values of 

from {0'}r=i. 

3. Even if Server2 had gained the information about 

®till cannot know the values of 
since he does not know the random permutation P. 

4. From Server2’s information he cannot ob¬ 
tain any information about without the 

knowledge of {9i}f^^. 

Compared with the case that the servers communicate 
mutually, less information can be known by each server 
when the servers do not communicate mutually. Thus, 
our protocol is also secure if the two servers do not com¬ 
municate with each other. Notice that the reviewed BFK 
double-server BQC protocol [3] is just a special case of 
our protocol: let all of {{xi, Zi)}'^^-^ be zeroes, and P be 
the identity permutation. 

According to Ref. the triple-server protocol |14j 
suffers from two kinds of attacks, which can gain the po¬ 
sitions {si, The fundamental cause lies in that the 

positions are determined during the interactive process. 
However, in our protocol, the positions are decided by the 
permutation P, which has been chosen randomly before 
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the interactive process. The two attacks are ineffective 
for our protocol. 

In our double-server BQC protocol, the servers are al¬ 
lowed to communicate mutually. If the two servers are 
joined together (the steps of Serverl and Server2 are fin¬ 
ished by one server), we can get a single-server BQC pro¬ 
tocol. It is obvious that the single-server protocol is as 
secure as our double-server protocol. 

Compared with the triple-server protocol [13], the 
client here is completely classical; However, the client 
in the triple-server protocol must have the ability to ac¬ 
cess quantum channel, such as the ability to receive and 
forward the qubits. 

IV. DISCUSSIONS 

In our protocol, there needs a secure classical channel 
between the trusted center and the client. This channel 
can be ensured by certain cryptosystem (block cipher or 
public-key encryption) in modern cryptography. More¬ 
over, it can also be ensured by ‘QKD-I-OTP’ (quantum 
key distribution HHI plus one-time pad). If the latter is 
chosen to protect the classical channel, the client is re¬ 
quired to finish the procedure of QKD. We should stress 
that, our BQC protocol itself does not require the client’s 
quantum ability. 

In our protocol, the client is completely classical, then 
its output is also completely classical. It is worth to 
notice the following two points. Firstly, the input of the 
computation can be a quantum state. Though the client 
cannot send quantum input to the servers directly, his 
quantum input can be generated during the process of 
quantum computation. Secondly, the client delegates the 
quantum computation to the quantum servers, so the 
computation is a quantum algorithm. For example, the 
client cannot perform Shor’s quantum algorithm m, but 
he can finish the algorithm through the interaction with 
the quantum servers. 

Our protocols (double-server protocol and single-server 


protocol) are very practical while being applied in the 
cloud quantum computation. In our protocols, the client 
is completely classical and no quantum channel is needed 
between the client and the servers. So the widely used 
classical computers and communication network can sat¬ 
isfy the client’s requirement in the implementation of 
cloud quantum computation. That means, in order to 
implement cloud quantum computation, the user (who 
acts as the client) is not required to buy new equip¬ 
ments. We only need to manufacture one (or two) uni¬ 
versal quantum computer (s) being used as the server (or 
Serverl, Server2), and set up a trusted center which can 
prepare Bell states. 

The role of the trusted center is very similar to the role 
of certificate authority (CA) in public-key infrastructure 
(PKI) [30] • In our protocols, the trusted center is needed 
to prepare Bell states and change the positions of the par¬ 
ticles. In addition, a private classical channel is necessary 
between the client and the trusted center. Compared 
with the triple-server protocol the trusted center in 
our protocols is more powerful. However, it is realizable 
using current quantum technologies. 

V. CONCLUSIONS 

This paper reviews the BFK single-server and double¬ 
server BQC protocols, the modified double-server pro¬ 
tocol in Ref. m and the triple-server protocol. In these 
double-server protocols, the client is completely classical, 
but the servers are not allowed to communicate mutu¬ 
ally. In the triple-server protocol, the servers are allowed 
to communicate mutually, but the cost is higher and the 
client must have the ability to access quantum channel. 
Then we modify the double-server BQC protocols and 
get a more practical protocol, in which the client is com¬ 
pletely classical and the servers are allowed to communi¬ 
cate mutually. We also point out that the double-server 
protocol can be easily changed to be a single-server pro¬ 
tocol without any loss of security. 
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